CVE-2026-25566
📋 TL;DR
This CVE describes an authorization vulnerability in WeKan's card movement functionality. Users can move cards to boards, lists, or swimlanes without proper authorization checks for the destination, potentially enabling unauthorized cross-board moves. This affects all WeKan instances running versions prior to 8.19.
💻 Affected Systems
- WeKan
📦 What is this software?
Wekan by Wekan Project
⚠️ Risk & Real-World Impact
Worst Case
An authenticated user could move sensitive cards containing confidential information to boards they control, potentially exposing private data or disrupting board organization across the entire WeKan instance.
Likely Case
Users moving cards between boards they shouldn't have access to, leading to data leakage, organizational disruption, or privilege escalation within the Kanban system.
If Mitigated
With proper access controls and monitoring, impact is limited to minor organizational issues within boards where users already have some access.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability is in the card move logic itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.19 and later
Vendor Advisory: https://github.com/wekan/wekan/commit/198509e7600981400353aec6259247b3c04e043e
Restart Required: Yes
Instructions:
1. Backup your WeKan instance. 2. Update to WeKan version 8.19 or later using your deployment method (Docker, Snap, etc.). 3. Restart the WeKan service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict board permissions
allTighten board permissions to limit which users can move cards between boards
Monitor card movement logs
allImplement enhanced logging and monitoring for card movement events
🧯 If You Can't Patch
- Implement strict board access controls and review all board permissions
- Enable detailed audit logging for all card movement operations and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check WeKan version. If version is below 8.19, the system is vulnerable.Check Version:
Check WeKan admin panel or run: docker exec wekan-app cat /app/package.json | grep versionVerify Fix Applied:
After updating, verify version is 8.19 or higher and test card movement between boards with different permission levels.📡 Detection & Monitoring
Log Indicators:
- Unusual card movement patterns between boards with different permission levels
- Cards appearing in boards where user lacks proper permissions
Network Indicators:
- API calls to move cards with destination parameters pointing to unauthorized boards
SIEM Query:
source="wekan" AND (event="card-moved" OR event="card-updated") AND dest_board_id != src_board_id